CLAIMS 



1 . A network comprising: 

a first tier of forwarding agents connected to a first tier of network devices; 

a second tier of forwarding agents connected to a second tier of network devices; 

5 and 

a service manager configured to: 

receive a packet from one of the forwarding agents; 
determine the tier of the forwarding agent; and 

send an instruction to the forwarding agent directing the forwarding agent 
1 0 to forward the packet to a network device connected to the tier of forwarding 

agents that includes the forwarding agent. 

2. A network as recited in claim 1 wherein the first tier of network devices include 
state tracking network devices that keep track of the state of connections and wherein the 

1 5 service manager is further configured to: 

in the event that the tier of the forwarding agent is connected to one of the state 
tracking network devices, determine whether the packet belongs to a connection that has 
already been assigned to the state tracking network device; and 

in the event that the connection has been assigned to the state tracking network 
20 device, selecting the same state tracking network device to receive the packet. 

3 . A network as recited in claim 2 wherein the state tracking network device is a 
firewall. 

25 4. A network as recited in claim 3 wherein the firewall is initially chosen by the 
service manager for a first packet that requests a connection and wherein the same 
firewall is chosen for a second packet that responds to the first packet. 
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5. A network as recited in claim 1 wherein the tier of the forwarding agent is 
determined by the subnet of the forwarding agent. 

6. A network as recited in claim 1 wherein the tier of the forwarding agent is 
determined by the port of the forwarding agent. 

7. A network as recited in claim 1 wherein the tier of the forwarding agent is 
determined by the inclusion of the IP address of the forwarding agent in a list for the tier. 

8. A network as recited in claim 1 wherein second tier of forwarding agents are also 
connected to the first tier of network devices. 

9. A service manager configured to distribute packets to multiple tiers of forwarding 
agents comprising: 

a network interface configured to receive packets from a first tier of forwarding 
agents connected to a first tier of network devices and a second tier of forwarding agents 
connected to a second tier of network devices; and 
a processor configured to: 

determine the tier of a sending forwarding agent that sends a packet; and 
send an instruction to the sending forwarding agent directing the sending 
forwarding agent to forward the packet to a network device connected to the tier 
of forwarding agents that includes the sending forwarding agent. 

1 0. A service manager as recited in claim 9 wherein the first tier of network devices 
include state tracking network devices that keep track of the state of connections and 
wherein the processor is further configured to: 

in the event that the tier of the forwarding agent is connected to one of the state 
tracking network devices, determine whether the packet belongs to a connection that has 
already been assigned to the state tracking network device; and 
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in the event that the connection has been assigned to the state tracking network 
device, selecting the same state tracking network device to receive the packet. 

11. A service manager as recited in claim 1 0 wherein the state tracking network 
5 device is a firewall. 

12. A service manager as recited in claim 1 1 wherein the firewall is initially chosen 
by the service manager for a first packet that requests a connection and wherein the same 
firewall is chosen for a second packet that responds to the first packet. 

10 

13. A service manager as recited in claim 9 wherein the tier of the forwarding agent is 
determined by the subnet of the forwarding agent. 

14. A service manager as recited in claim 9 wherein the tier of the forwarding agent is 
1 5 determined by the port of the forwarding agent. 

15. A service manager as recited in claim 9 wherein the tier of the forwarding agent is 
determined by the inclusion of the IP address of the forwarding agent in a list for the tier. 

20 16, A method of distributing packets to multiple tiers of forwarding agents 
comprising: 

receiving packets at a service manager from a first tier of forwarding agents 
connected to a first tier of network devices and a second tier of forwarding agents 
connected to a second tier of network devices; 
25 determining the tier of a sending forwarding agent that sent a packet; and 

sending an instruction to the sending forwarding agent directing the sending 
forwarding agent to forward the packet to a network device connected to the tier 
of forwarding agents that includes the sending forwarding agent. 
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17. A computer program product for distributing packets to multiple tiers of 
forwarding agents, the computer program product being embodied in a computer readable 
medium and comprising computer instructions for: 

determining a corresponding tier of a sending forwarding agent that sent a packet 
5 received at a service manager from a first tier of forwarding agents connected to a first 
tier of network devices and a second tier of forwarding agents connected to a second tier 
of network devices; and 

sending an instruction to the sending forwarding agent directing the sending 
forwarding agent to forward the packet to a network device connected to the 
10 corresponding tier of forwarding agents. 

18. A service manager configured to distribute packets to multiple tiers of forwarding 
agents comprising: 

means for receiving packets from a first tier of forwarding agents connected to a 
1 5 first tier of network devices and a second tier of forwarding agents connected to a second 
tier of network devices; 

means for determining the tier of a sending forwarding agent that sends a packet; 

and 

means for sending an instruction to the sending forwarding agent directing the 
20 sending forwarding agent to forward the packet to a network device connected to 

the tier of forwarding agents that includes the sending forwarding agent. 
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